Amazon says email banning TikTok from employee phones was ‘sent in error’
twitter.com
twitter.com
https://www.theverge.com/2020/7/10/21320196/amazon-employees...
https://www.nytimes.com/2020/07/10/technology/tiktok-amazon-...
1. Devices owned by Amazon, for work
2. Personal devices with the amazon email added directly
3. Personal devices with amazon email added on Work profile
Could not find this info in the articles or tweet.
A lot of them do not block apps (or remove them).
Only supports Apple though! Not Android.
I'm always interested as it's my work so I'll probably give them a spin.
Android only:
Apple only:
https://github.com/cmdmnt/commandment
Both:
I've been using Intune at home because I use it at work too and I already had a personal O365 setup. It was nice to have a fully owned instance when I was learning it, but I'm trying to scale back my costs now so something like this might just suffice.
In the 'old' days, there was an app called device admin which would control the phone. This app would be supplied by the MDM vendor. This could leverage APIs from various vendors. Samsung had Knox but almost every phone vendor had their own plugin.
This was a huge PITA because each MDM feature only worked on manufacturers A and B and very often was limited to OS versions Y and Z. It meant we had to validate each phone and OS version and have a long list of what phones people could and couldn't use. It was a nightmare as an admin. Users hated it because they often only found out after they'd bought the phone. Samsung was indeed one of the best here, I have to agree.
Since then Google has thrown this overboard and started afresh with Android Enterprise. Controlled only by Google, and offering new ways of management like the work profile which is basically a kind of "phone inside a phone". Have your work profile managed by work and the rest of your phone to yourself.
For company-owned phones they also still have more comprehensive management options like COBO and COPE. But as long as the phone supports Android Enterprise, it supports everything.
Sadly some vendors in particular Samsung are fighting this approach because they feel they have invested too much in the old method. For example Samsung won't support Google Zero Touch auto-enrolment, having instead their own alternative Knox Mobile Enrolment. This is again making things more difficult for admins. But because Samsung is such a big party, and KME is free, we have gone for it anyway (Also Google Zero Touch is not available very widely yet, each reseller has to support it)
As an Admin I'm glad to see the end of the old management model. It's deprecated as of Android 11 (and already severely limited in 10) but we've already dropped it altogether.
And no, for managing Apple phones you don't need a Mac. You just need this for manual installation of management profiles, if you use an MDM you don't need it.
However if you want to manually supervise phones (instead of using Apple DEP / or Automated Device Enrolment as they call it now), you do need one. But this is really rare now.
Some of the things
- Auto app installs: We have a lot of apps people need for work, like the VPN, Outlook, Teams etc. And apps they need for their specific location or job role. The MDM takes care of installing those so the user doesn't have to figure all this out.
- Autoconfiguration: There's a facility called AppConfig where you can push config settings to apps that support it, making things easier on the end user.
- Network (and other settings) configuration: Pushing all the certs people need to connect to our wifi. And we push Per-app-vpn settings for the apps that need it.
- Security validation: Do people not have outdated company apps or OS? Do they have the security app (Lookout)?
- Security settings management: Make sure people have their phone encrypted and a pincode set so important data is not lost in a taxi.
In fact wiping is one of the things that happens very rarely. Especially as we enforce encryption and a decent PIN, it's not as much of an issue anymore to wipe a phone as soon as we can. A lot of users get hung up over our ability to do this, but on Android we can only wipe the work profile anyway (and even on Apple we don't normally wipe the whole device, just the company apps). Unless they call us and ask us to wipe it because they lost it :P But a lot of them seem to think we're just sitting there all day wiping phones for fun.
My assumption was that any apps installed on the personal partition were off limit for the MDM.
In other modes (COBO, COPE) it's not but those are much more difficult to enrol, as you have to do it from the setup wizard on a new phone or after a factory reset. So you don't happen to get into this mode by accident. They're only used for company owned phones (this is what the CO part stands for).
Of course most companies provide phones, but many users prefer to use their own, both for the benefit of having to carry only one, and because they have more choice.
Another big benefit of work profile is that you can switch all work stuff and notifications off with one click! I really like it overall, it gives great separation.
https://variety.com/2020/digital/news/amazon-bans-tiktok-emp...
Sounds more like 'pulled after huge feedback'.
Though personally I'd agree with this decision. TikTok seems to be a particularly bad apple: https://www.reddit.com/r/videos/comments/fxgi06/not_new_news...
If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere.
...and we only know about this issue now because iOS 14 adds clipboard snooping notifications - and that was only a month ago! Think about the stuff that the app could be doing that we don’t yet know about.
There’s too many bloody-obvious security vulnerabilities that are decades old but don’t get fixed until they either become a meme (like SQL Injection) or the platform vendor does something about it (iOS 14 clipboard notifications) - and don’t forget that the SIGINT community is sitting on millions of dollars worth of zero-days that they won’t disclose to vendors unless they feel like it - so I fully expect there to be more surprises in TikTok - and other apps - in the years to come - probably indefinitely.
Not trying to derail this via whataboutism, I just feel like the core HN ethos is lost when we mindlessly repeat the obvious geopolitically-driven narrative here without any critical thinking.
What I definitely do understand is Amazon's concerns with just the base level of data collection that's seemingly the norm in our industry. Which prompts the quesiton, why are we comfortable as a society with this sort of collection, by anyone?
[1] https://www.businessinsider.com/apple-ios-14-catches-reddit-...
Here's a rundown of just general apps that would be on everyone's home screens doing the same thing.
Really Apple should take a stand and give all of them 30 days to fix their apps or get banned.
But TikTok annoyed me in particular for a long time. Nothing to do with geopolitics, I already hated it before I knew it was owned by China and everyone started banning it.
It was just that for the past months every time someone forwarded me a stupid video I was supposed to like, it had a TikTok logo on it. So in my view this became the source of "stupid videos people bother me with". Not exactly a charming quality.
Especially with the lockdown it became extra annoying, every day I got multiple stupid lockdown videos and the ones with people doing stupid stuff and then the coffin dancers thing.
So that's my personal reason for hating on TikTok. The privacy revelations just sealed the deal. Not saying it's a valid reason for everybody but it's my reason :P
This quote comes to mind:
> I used to be with ‘it’, but then they changed what ‘it’ was. Now what I’m with isn’t ‘it’ anymore and what’s ‘it’ seems weird and scary. It’ll happen to you!
But TikTok associates itself by putting their logo on the videos which is something I haven't seen before.
Woooooooorrrrld staaaaaaaar
Also if you ever see a 7 second vertical video, sleep well knowing you just watched a Vine (not really a logo, but association all the same)
It's just content watermarking.
Watermarking is essential to preserve your brand online. I assume you remember eBaumsWorld - and how they put their watermark and footer on all image-content that they rehosted: because those images would appear verbatim in FW:FW:FW... chain emails and shared over AIM,YIM,MSN,IRC, etc.
Back in the day, eBaumsWorld and others were criticized for putting their watermark on content that they rehosted, especially when they didn't own, produce, or commission that content. At least the vast majority of the content on TikTok was directly uploaded to it, and TikTok's watermark includes the username of the relevant account.
Their animated logo is obnoxious and distracting - but when I compare it to the DOGs on American TV news channels it isn't so bad, it's actually unobtrusive in comparison.
Thirty days later the show of brinkmanship ends up with a bunch of iPhone users unhappy that half of their favorite apps work.
This wouldn't be as big an issue if the PRC was a NATO ally, or least had a reputation for government transparency and accountability - and wasn't asserting ridiculous territorial claims - and didn't have an egregious human-rights record - and wasn't actively suppressing freedom-of-expression - and so on. Take away a couple of these issues and TikTok's suspicious business conduct over the past few years would be about the same level as scummy American Freemium game makers. I stress that (and despite appearances) I'm trying not to make a Sinophobic argument.
At the same time, I recognize that companies in China need to integrate themselves with the CCP/PLA/etc in order to succeed in that market.
What are other companies? Those that doesn't pose a threat? like those ones only produce cheap toys and clothes?. I think as long as Chinese government remain as independent and "different", anything comes out of there that really challenges current status quo would receive similar criticism like yours, regardless what or how those company behaves. Curious how do you recognize those companies "need to integrate themselves with the CCP/PLA/etc"?
Your password should never be in your clipboard at least with iOS. If you’re using either the native password manager or a third party password manager, the password manager is directly integrated with the keyboard and would auto fill into your app.
https://techcrunch.com/2018/06/05/password-autofill-in-ios-1...
The ones that particularly annoy me are the ones that haven't updated to the new Android biometric API versus just supporting the old fingerprint API. I'm looking at you Chase mobile app.
The other is the way they hide what they're doing so elaborately.
I wouldn't call it a national security concern, no. Someone who works with critical or military infrastructure should have a locked-down phone anyway for work stuff.
But really I wonder how this kind of stuff is OK in the eyes of Apple with their self-proclaimed privacy focus. I'm pretty sure if I were to submit an app that does all this, it'll be rejected right away. Popularity seems to overrule that.
I suspect you’re right and would be very interested in the results of this experiment if you (or anyone else) happen to undertake it.
We found out other apps too (like LinkedIn) constantly check the clipboard, and one HN commenter here said it was due to a text editing library, nothing intentional.
Literally the only fact is that it's a Chinese company.
And it's not like there's even much it seems like they could do, with how sandboxed phone apps are. I'm not saying iOS or Android are perfectly secure, but it't totally different from installing something on your desktop with root permissions.
Either it's just generic hate for China that's bizarrely gone viral, or else it's a story intentionally being pushed by the US government for god-only-knows what political reason, like leverage in trade negotiations or something.
But it's completely weird, and nobody should be taking it at face value.
https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi...
https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pd...
Things they found - Excessive data collection - Privacy policies that allow distribution of said data - Execution of OS commands - Insecure cryptography usage - Potential SQL injection code from user defined variables - Storing of API tokens - Webview enabled by default along with insecure webview enabled
Other social networking and entertainment apps are crammed full of tracking code, analytics, advertising networks, that all collect excessive user data, don't put it in their privacy policies, etc. And similarly, we hear about bad use of cryptography and SQL all the time.
Apps can be pretty bad in general with these things.
Now obviously, apps and code in general should be improved.
But the question here is, is TikTok really that much worse? That it's such a worse threat than others, that it needs to be banned? Because that's what I still don't see evidence of.
The issue for me is where the data is going and who has control of it. A quote from the article about TikTok trending today (https://news.ycombinator.com/item?id=23832183)
All Chinese Internet companies are compelled by the country’s National Intelligence Law to turn over any and all data that the government demands, and that power is not limited by China’s borders. Moreover, this requisition of data is not subject to warrants or courts, as is the case with U.S. government requests for data from Facebook or any other entity;
https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi...
https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pd...
Things they found - Excessive data collection - Privacy policies that allow distribution of said data - Execution of OS commands - Insecure cryptography usage - Potential SQL injection code from user defined variables - Storing of API tokens - Webview enabled by default along with insecure webview enabled - App copies data to clipboard. Sensitive data should not be copied to clipboard as other applications can access it. - Files may contain hardcoded informations like usernames, passwords, keys etc.
I suspect Amazon realized late what a legal mess it is to ban an app on their employee's cell phone when they have no clear legal basis or governmental guidance. They banned employee using Huawei phones when I was working there, for some things -- don't remember exactly. But in that case, US government already banned it for its employees, so there is precedence Amazon can claim as legal basis.
Amazon probably decided most employees don't have anything too sensitive and it's not worth buying everyone a phone.
We can't see the app list on the personal side in work profile mode, BUT we can specify some that are a no-go. I'll show up as a compliance violation. But we can't view the list anymore like we could do with the pre-work profile Android Device Admin management (and still can with Apple).
We're not blocking any apps ourselves right now but it is possible. We do grant all BYOD phones access to our network, so for that reason we would want the capability to block any known threats if they are around.
We can also control some minor things on the personal side, like a pincode requirement and forbidding of sideloading and rooting. But in general we have very little visibility and control, which is the way I (as an admin) like it too. I only want to know what I really need to know especially on the personal side. We can (and do) also block copy/paste from work profile to personal, as data loss prevention, but we allow it the other way around.
In general users complain a lot about the work profile being separate, and not being able to integrate their personal and work calendars.. But for personal privacy it's a big win IMO. Apple has something similar since iOS 13 (called User Enrolment) but it's still a bit too limited to be sufficient for us. And it requires Apple federated accounts which have some requirements that are impossible for us to meet :(
Oh, that's very interesting! I knew about the PIN requirement as an example of control outside the work profile, but I didn't know this was possible. It makes sense though.
Good luck with that, if users have root they already have full control (and can thus tell whatever app exactly what it is expecting.)
Unfortunately, middle managers gotta middle manage. And they don't get the adrenaline rush of having people under them unless they can tabulate those people.
Which is why a lowly web dev like myself is expected to carry around a company-issued phone even in my off hours. In four years I've never needed it.
Are there any pager networks left in the US? I've always been interested in them out of historical curiosity because I was too young to use them when they were actually a thing, but from what I understood, pagers are pretty much not a thing anymore.
I imagine pagers are probably used in highly secure communications (military, statecraft), because the thing being paged doesn’t have to give away it’s location, or even the fact that it received the message.
* the paging app * sms-based text * phone call
as well as what order and with what delay you want them to attempt to engage you. iirc you need at least two options such that in the event of an issue with one network/application they have an alternative means of potentially reaching you.
https://www.businessinsider.com/jeff-bezos-phone-hacked-saud...
https://github.com/ddz/whatsapp-media-decrypt
They never responded with an actual malware analysis on the file they claimed might be responsible.
The only evidence left after that was a claim of higher data usage which has to be weighed against the alternate explanation for how this got out:
https://www.forbes.com/sites/martingiles/2020/01/24/report-b...
if I were a billionaire I'd basically not stop until I got to the bottom of this one. everyone is vulnerable.
> Be kind. Don't be snarky...Comments should get more thoughtful and substantive, not less, as a topic gets more divisive.
> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.
To the second point, however, I do think you took the worst possible interpretation of swyx's comment, which was basically "nobody cares that the person in question is a murderous tyrant, but he hacked Bezos's phone and so is a bad person now." I don't think that's what he was saying at all, especially given the end about "more than he already is." Whether we like it or not, one of the primary reasons that Saudi Arabia is tolerated in the West is their economic importance, and their connections to the elite, almost entirely because of their wealth. That starts to crack if they go after the elites directly. So I took the comment as basically saying that it didn't seem to serve MBS at all to hack Bezos directly, as it would only (further) delegitimize him interntionally.
To more seriously address the various possible interpretations of the comment in question... yours is a reasonable interpretation, but I don't think I was unresponsive to that interpretation. Of course ethical people object to MbS's previous evil deeds. Still, those are his deeds. If global opprobrium didn't sway him before, there's no reason to believe it did so more recently. If there is evidence that some electronic communication that appeared to come from MbS contained malware, that evidence should be analyzed in itself. It shouldn't be dismissed by vague unsupported perceptions of MbS's interests and motivations. It's not as though Bezos is universally adored, even among other satanically wealthy reptiles.
It's not an accident that one of the stupidest, most theocratic countries in the middle east receives the most weapons and support from the USA.
We don't want a strong middle east. This is why countries like Iran, Lebanon, Syria are labelled as "terrorist".
Both countries and both rulers of said countries should be international pariahs.
Iranian women have never lost their rights to drive, to appear in public, to have lives of their own. Iranian women and men both vote in elections to select their leaders. Iran has only fought defensive wars with its neighbors. Kingdom of Saudi compares very poorly in all these categories.
Iran is running a massive offensive ethnic cleansing in Syria and has been declaring its intent to do the same in Israel for years. This was headed by a general (not 'diplomat') who was on both the EU and US terrorist lists. Its foreign policy is support of nearly every tyrant and terrorist organization out there.
Of course, there's some flimsy excuses (the US once upon a time supported overthrowing someone the Islamists also helped overthrow, and there was a brutal 'security service' which the Islamists retained in full, adding a single letter to the name), but they're not very interesting. I could have run the same list of excuses for Saudi with different names and places, and it'd be the same apologia for a dictatorial theocracy which spreads fanaticism for ideological and domestic reasons.
Iran has helped the internationally-recognized government of Syria battle the internationally-recognized terrorist group ISIS, whom USA created and supported throughout its existence. This happened very recently: how is it that you've forgotten? Perhaps you were distracted by the by-now-obviously-false-flag "gas attacks"? The timing was just so convenient! [0] Tell that "ethnic cleansing" bullshit to the Yazidis and Kurds. Those few who weren't butchered by ISIS are glad to see the internationally-recognized government of Syria in control again.
This was headed by a general (not 'diplomat') who was on both the EU and US terrorist lists. Its foreign policy is support of nearly every tyrant and terrorist organization out there.
Potayto, potahto. What did we call Colin Powell back when he was circling the globe lying about WMDs? (He was good at it, because he had practice from lying about My Lai.) What do we call Pompeo now that he's circling the globe lying with his every breath? Pompeo was so sad his pet project ISIS went belly up, he forgot what business he's in. I wonder how many meetings he has on tarmacs in the Middle East?
...not very interesting...
This is projection. Regurgitating 4yo propaganda that even USA war media has by now retracted convinces no one. By any measure, the Sauds are worse than the elected Iranian government. The reason we still menace the Middle East is not because some person did so and so to some other person in some place no one can find on a map. The reason is, we don't have democracy in USA, so we citizens can't force our government to bring the troops home.
[0] https://scheerpost.com/2020/07/02/the-threat-of-peace-and-me...
As for the gas massacres, the conspiracy theories just get madder and madder. Obviously, the rebels are supposed to have attacked themselves for the XX time after seeing all the previous gas attacks led to no reaction? While never ever using them against Assad troops? The Assad regime being the only one in theater with the equipment and capability of staging a gas attack? Some people are just shilling for mass-murder.
The Iranian government isn't elected. Everything is controlled by the Supreme Leader and IRGC, and the 'elected' offices have no power. The 'elected' offices where the only people who are allowed to be elected are those that support the regime[0], and protesters are killed[1].
You're right about one thing - the Saudis are not much better. Then again, they didn't support a WMD attack and deny it later, like Iran apologists do. Nor do they officially have genocide aims against other countries. Maybe the apologists secret admire the Mullah's aims, and that's why they defend the regime.
[0] https://apnews.com/44ad5910fa3e1a297d6c0b5ad6c3c59f
[1] https://www.reuters.com/article/us-iran-protests-specialrepo...
There was no "gas attack". Some murderous slaving ISIS criminals took a sledgehammer up on the roof, knocked out some holes, and shoved some empty canisters into them. Then they mixed some bleach with some muriatic acid and left the scene. Later, there was of course some chlorine residue. But simple physics proved that full canisters of poison gas hadn't been "dropped out of helicopters": the roof wouldn't have stopped so many of them. [1] Actual gas bombs of the sort that USA sold to Saddam for use against Iran are carefully constructed devices that can actually be dropped from aircraft and expected to distribute poison gas. Dropping bare storage cylinders only works in the movies. The real conspiracy theory is that the internationally-recognized government of Syria had anything to do with those attacks. They had neither means nor motive. The "moderate rebels" (really ISIS) that USA had been supporting had both.
Of course you don't care about details. Even your pose of criticism of Saudi is cynical. You want to sell the Saudis bombs to kill Yemeni children right up until they don't want to buy them anymore, at which time you'll want to start bombing KSA. Mostly you just support status quo USA policy for the last 70 years. That is, we kill lots of brown and black people so that the public can be buffaloed into giving armaments manufacturers obscene amounts of money. The public would prefer to spend that money on literally anything else; you disagree. You'll probably make a show of declaring that you're actually more against war than I am, but your religious devotion to every lie that the war media has ever tossed off shows where your heart is. Pacifists oppose killing innocents, both through sanctions and through the wars for which sanctions are pretexts. The Middle East is broken for the same reason that Latin America is broken and Southeast Asia was broken for a long time: USA broke it. The best thing we can do for them is the best thing we could have done for them in the 1950s: stop interfering with their governments, stop providing armaments to various parties, and stop killing them.
[0] https://cepr.net/images/stories/reports/venezuela-sanctions-...
[1] https://thegrayzone.com/2019/05/25/opcw-syria-gas-attack-sta...
Nobody believes the lies regarding the WMD massacres, we know Assad did these (and so much more). It required rebels with no advanced weapons, much less chemical weapons, to attack themselves over and over, while never ever attacking Assad. The Douma massacre in particular wasn't bleach, it was a different chemical agent[0]. The nature of Assad's attacks is well documented[1].
There's nothing 'pacifist' about shilling for mass murder. It's like those 'pacifists' Orwell attacked during WW2 because they were equating the Allies with the Nazis, that is, being 'objectively pro-fascist'.
That's a very cynical position, despite your alleged criticism of Saudi. I bet that as soon as Saudi ignores US and buys weapons from Russia we'll hear a different tune from your likes.
[0] https://www.bellingcat.com/news/mena/2020/01/15/the-opcw-dou...
[1] https://www.bellingcat.com/news/2020/04/21/the-open-source-h...
As an example -- consider that ISIS was shipping ~$160 million in crude oil via smuggling routes to China. Even with all our power, it is not trivial to track such things.
What I am saying is that there are interests here that are enormous and impossible to understand.. some not even based upon nation-state and totally a-political.
The fact that you believe you have a definitive assessment regarding the gas attacks reveals your naivete.
Take a look at the history of the Assad regime and how we destabilized the region by funding his opposition. Take a look at the history of Egypt or Libya over the past 40 years. One day Gadaffi was an American hero, the next day we are cheering for his downfall. Sensationalist stories of rape/murder/torture being spread through the media. The truth is probably somewhere in the middle.
Look at the sort of stuff we spread during the Gulf War: https://en.wikipedia.org/wiki/Nayirah_testimony
This is all to say -- neither of us really knows what we are talking about. But you seem to have a very "good vs. evil" approach to the world that is naive at best.
We in USA don't actually have to understand conditions in other nations. We just have to pay attention to our government and media, and remember what they've done even after they've stopped talking about it. They lied us into war with Spain, which led to decades of murder and oppression of Puerto Ricans and (especially) Filipinos. They lied us into WWI, which led to the Nazis. They lied us into Vietnam, which caused millions of deaths in southeast Asia. They lied us into Kuwait, which caused 9/11. They lied us into Afghanistan, in which USA soldiers are now dying who weren't yet born when the lies were told. They lied us into Iraq, which has seen horrific loss of life oh and also the creation of ISIS. They lied us into Libya, which peaceful prosperous nation was replaced in six months by a smoldering hellscape, complete with slave markets. They lied us somewhat into Syria, where we and our ISIS allies were (thank God) defeated. They tried to lie us into Iran...
(This is not even to mention the dozens of nations whose elected governments we've deposed in favor of authoritarians in spooky ways, at least as long ago as 1953 in Iran, as murderously as 1965-7 in Indonesia, and as recently as last year in Bolivia.)
Gosh, what can we conclude from this fairly consistent history? I submit that when we're fed some pretext for war, we should assume it's a lie and oppose the war for which it is told. If we're ever able to do so consistently (and perhaps the last two entries in the list above are cause for hope?), it will result in a greater global flowering of peace and prosperity than we've ever seen before.
[0] https://thegrayzone.com/?s=bellingcat&orderby=relevance&orde...
[1] https://www.nytimes.com/2019/12/01/business/media/open-sourc...
[0] https://www.truthorfiction.com/theodore-postol-mit-paper-syr...
One less charitable than I would wonder just why you're so committed to this exhaustive parroting of trivial military-industrial complex dogma, to the extent that you'd accuse a random pacifist (not "Leftist") of secretly (so secretly he doesn't himself know it!) supporting genocide. USA doesn't fight in wars in order to "stop genocides". (Again, we were ISIS allies in Syria and even sometimes in Iraq. That is not to mention the hell-world we created in Libya; a less powerful nation would certainly have been called before the Hague for that pile of atrocities.) We fight in wars in order to transfer public assets to armaments manufacturers and to their puppets in government and media, and those puppets will employ any pretext in pursuit of that goal. We gave the publicly-admitted portion of our military $750B this year. The citizens of USA (and everyone else) would be safer if we spent a third of that.
[0] https://wikileaks.org/opcw-douma/document/20190227-Engineeri...
Your link says
>Bezos' phone appeared to be infiltrated after he opened a video file sent from the crown prince's number on WhatsApp.
Parsing is hard, and parsers are buggy and lead to all kind of unsafe C code
https://www.okta.com/blog/2020/04/what-the-jeff-bezos-whatsa...
I know that if you craft your buffer overflow just right it will overwrite other parts of memory with the new function.
But how do you know what parts will get overwritten?
Does that mean the new function can do almost anything?
https://stackoverflow.com/questions/14760587/how-does-a-nop-...
https://stackoverflow.com/questions/49620893/return-into-lib...
And yes, arbitrary code execution is a common goal of these exploits, though it may not always be possible--sometimes you only get a DoS attack or such.
The article has some detail about the remote code execution part of this exploit.
“What this means is that there was a software flaw in the WhatsApp code for handling MP4 media files. If an attacker triggered the flaw, the function in question would crash in a way that could allow a potential attacker to gain “RCE” or Remote Code Execution.
In layman's terms, this means the attacker could inject his own code into the application and, by triggering the flaw, make the application to run with all the privileges and access of the WhatsApp application itself.”
1) Discover/buy/steal Bezo's Whatsapp number (how did they do that...)
2) Discover/buy/steal a 0-day bug in Whatsapp.
3) Write and compile a program that reads SMS from the OS and beacons it to some server you control.
4) Create a corrupted video file that would trigger the video parsing bug, and within that video file place the compiled program from the previous step in the correct place so that it gets executed.
5) Send to Bezos.
This is usually no longer the case in modern applications. So attackers instead string together short snippets of code from the application itself and jump around between them to basically do what they want.
It's become more complex due to mitigation, but the general principle is the same.
Don’t blame them, they don’t want the kind of leaks that happened last cycle.
I know there's plenty of political implications and a lot of discussion here is on that (which is interesting in its own right), but I wonder if there's opportunity here for a potential competitor.
But if the Chinese government wants to prop up TikTok and pick them as the winner, they can.
Although it seems the online records are disappearing fast. I could not find a good source of the TikTok history and key figures any more...
It appears to me that TikTok is just a perpetuation of exclusivity in Social Networks (the same way kids exited FB when their parents signed up) ...
Sure its just another algorithmic-based feed. But in my experience (and from talking to a few ppl who enjoy TikTok), the For You page is a differentiator. It's like a combination of what's trending, what's recent (time wise), and what you've spent time interacting (watching, liking, commenting) with previously.
Again all platforms do some form of this, but just saying TikTok does it in a pretty addicting way.
Also combine that with the fact that TikTok videos are so incredibly short that by the time they're over, you haven't even decided whether or not you liked it (no doubt by design), which means you can endlessly consume content.
Also, I've heard that TikTok has better (read: better for comedy-style content) tools to edit videos in the app
surprised there hasn't been any controversy about that - tiktok is a predator's paradise.
The way the discovery tab works also created a meta game: Alt TikTok, Deep TikTok, Elite TikTok, ...
The exclusivity aspect is there too, very few users are over 30, but it's not the driver.
deep tiktok is weird video effect stuff, deep fried meme kinda stuff... I dont want it.
Practically I think it's more diverse content and easier access to other people/fame/glamour for kids than Instagram, Snapchat, or even YouTube/Twitch/etc, since those platforms have been cornered by an existing group of "influencers."
It's probably just a different kind of dopamine hit that kids can't get elsewhere.
I'm tired of "national security" being thrown around willy nilly. If the US government has proof that this is a security risk, they need to be public and transparent with their proof. Anything short of that and I'm not on board with "a ban".
That said, I agree that young kids and those who compulsively use social networks are fickle and are likely to move onto another network when the current one ceases to keep their attention.
You don't need proof when the CCP is itself giving you so much evidence. Infact I should be asking Americans as to what is wrong with you guys that you are supporting a totalitarian government? The CCP passed a new cyber security law in January of this year (called the MLPS 2.0) where it has given itself full power to have unrestricted access to any data transmitted or stored within CCP.
“There will be no secrets,” writes Steve Dickinson on the China Law Blog. “No VPNs. No private or encrypted messages. No anonymous online accounts. No confidential data. Any and all data will be available and open to the Chinese government….there will be no place for foreign-owned companies to hide.” [1]
What about foreign investors? It gets even worse!
"It’s exactly as bad as it sounds, and it gets worse. The MLPS 2.0 is supported by two additional pieces of legislation, both of which strip away any protections, safeguards, and loopholes that might once have been used to maintain the sanctity of corporate data. Both went into effect at the beginning of this month.
The first is a new Foreign Investment Law which, as Dickinson notes, treats foreign investors exactly the same as Chinese investors. Although this has been billed as a means of simplifying the investment process, in practice it strips foreign investors of many of the rights they previously enjoyed. Areas of the market previously closed to foreign companies will remain closed.
The second, as reported by Engadget, establishes a new set of guidelines surrounding encryption. Again, on the surface, these seem like they were proposed with the common good in mind. It’s only on closer examination that cracks start to appear." [1]
And you are telling me here that this isn't a threat to the National Security? TikTok is obligated to share your data without even being asked for because of this Chinese law. And before you say that TikTok operates in US and not in China, its parent company ByteDance is a Chinese company. You cannot form a Chinese company without adhering to these laws! Do you really want the US Government to come out and confirm this when China has itself passed such a law?
[1]: https://www.datacenterdynamics.com/en/opinions/chinas-new-cy...
The US government should not ban me from choosing to use a crappy entertainment app. Yes, I realize that an app which is owned by a Chinese company who stores its servers and data in China is governed by Chinese laws.
> what is wrong with you guys that you are supporting a totalitarian government?
I'm not. I'm just saying that anything short of a blanket ban on an entertainment product is not tantamount to "supporting a totalitarian government". You are missing all of the shades of gray. You can't post to HackerNews without using {a phone, a computer, and internet connection, etc} which provided revenue to a company in China, which according to your logic "supports the totalitarian government".
Also there is a philosophy called accelerationism[1] which is the inverse of what you propose, but which may get to the end point (freedom from the CCP) faster than your proposed solution.
Edit: Oh, I forgot the one staring me in the face—Youtube! It's no less of a social network than TikTok.
Google is completely incapable of coming up with their own successful social network.
Orkut: stagnated and killed
G+: design by committee as you said
YT: acquired but the social aspects are down the drain
We can complain about FB and Zuckerberg as much as we want but they knew how to evolve the network and keep the users
It's like Google forgot that a social network needs to be social. Limiting how many people could get on G+ created hype for sure, but whenever someone got a invite, they realized none (or very few) of their friends were on it, and quickly forgot about it.
The slow rollout approach worked for GMail because your friends didn't need GMail for it to work for you.
They have tried to launch at least 2 of their own, and both flopped hard.
Youtube is successful coz of google infrastructure not google decisions/methodology.
Now Google is trying to move Youtube into becoming a hollywood-lite experience and providing major support to entrenched hollywood celebs like will smith/brie larson(they even bypassed monetization policies for larson - her first video launched with full monetisation in play)
While they are still in the App Store
>
Vine was 6 second long video clips. Comparing Vine to TikTok is somewhat like comparing TikTok to YouTube videos. They are different.
Lot of TikTok popularity has come from offering songs/lip syncing functionality (done better by their acquisition of musica.ly). That wouldn't have worked on 6 second Vines.
TikTok allows 15 second videos (only 2.5x the length of Vine videos) but also has a way to string multiple videos together for 60 seconds of play time (10x longer than Vine had).
So this is actually a pretty fair comparison (old Twitter @ 140 vs new Twitter @ 280) if you ignore stringing them together.
As an aside, it's insane to me that the differentiating feature of an entirely new video hosting platform can simply be the length of the content it supports.
The world of tech companies is truly bizarre. Why doesn't Google launch dozens of Youtube variants under their own branding with their own slightly different length restrictions to just dominate the market?
The music integration was the biggest example of this, and probably why the lip-syncing/dancing videos became so popular on the platform.
Which is different from ByteDance, which is the company that owns TikTok, for those confused like me.
In my opinion, are still "evil" in terms of hijacking our brain, but I am a bit fed up with those prevailing political prejudice nowadays for anything related to China.
https://www.reddit.com/r/videos/comments/fxgi06/not_new_news...
TikTok is really exceptionally bad in this regard.
Are you referencing something specific?
https://techcrunch.com/2020/07/01/lasso-facebook-tiktok-shut...
The best thing those old men could do is legislate system level privacy protections onto IOS and Android so an app can never get the level of info they're worried about.
I'm not going to get into whether or not this actually makes sense, but he is a massive celebrity among young millennials/gen-z.
He definitely made a ton of money, probably most of the money Mixer was investing in their entire launch, and now he's completely free to triumphantly return to Twitch (or take another deal).
I'm not sure how going to Mixer is a knock on him.
https://blog.hootsuite.com/tiktok-stats/#:~:text=TikTok%20ha....
It looks like the median user is 18-24... but that's still quite young compared to "tv news" watcher where the median age is around 60.
https://capitolcommunicator.com/nielsen-provides-data-on-med...
If your entire worldview is ageist, works strictly on stereotypes, and encompasses only the United States, that might be true. But there are companies, organizations, and governments around the world locking out TikTok.
Tiktok is not some extra special danger, except to those who have extra fear of a Chinese owned company. India has banned Tiktok, around the same time they've had border skirmishes with China and are running a big nationalist government.
I'm not at all in favor of the US government banning apps unless the US government publicly and transparently shows the proof of security risk first. Anything short of that just appears to be politics and is likely to just be a negotiation tactic.
I prefer more privacy controls and transparency (which gives consumers / Attorneys General the ability to sue the app company), but I don't want my government to see the Chinese government's policies as the thing we need to compete with.
I think the US needs to look outward to functional democracies before we try to "inspire" other countries with our broken corruption. What the USA calls lobbying other OECD countries is criminal bribery and all other political dysfunction in the US rolls downhill from there.
I'm not blinded to think "China is doing good stuff", but I'm highly suspicious that we should see ourselves as any better than them right now. We are completely unable to address lots of our own {civil, legal, justice, health, economics, ethics, etc} issues.
As the follow-up tweet says: "Completely independent of the specifics in this instance: get a second device before installing an employer's config profile on your personal device"
I'm with you though... If an employer wants to manage my device, they can provide the device.
The first of these could sometimes have implications for ownership of personal projects created using the device, which was one of many reasons I picked the second option, but it was absolutely permitted at least for any case where the company cared about you having mobile account access.
I even saw a guy using the code review site on his mobile, on BART. That was dumb from the standpoint of infosec, usability, and mental health, but shows how much is possible in the browser.
"""BeyondCorp began as an internal Google initiative to enable every employee to work from untrusted networks without the use of a VPN."""
Disclaimer: Googler, opinions my own.
Seriously, they could be logging your exact location, remotely activating the camera or doing any number of disgusting things.
Requiring the use of a spy should not be a factor in an employment setting, of course we're seeing this is the case and it is very offputting.
Thankfully not something I need to worry about though.
Installing an app that relays GPS and camera may be possible, but permissions need to be granted by the user explicitly- the MDM server cannot grant those permissions.
Google has in my opinion the better approach with work profile. Only give the MDM control and visibility over the work area and nothing else.
Apple has started heading into this direction with User Enrolment but it's not sufficient for most companies as it only allows built-in apps to be used for both work and personal data. And it requires Apple account federation which is problematic.
> Microsoft does the latter, so it wouldn't surprise me if Amazon does likewise.
Not true (source: current MSFT employee). More detailed explanation below, as neither former nor latter describes MSFT accurately.
So, for most teams and positions (there are many exceptions), you don't get a dedicated work phone. So yeah, if you want to access work stuff on a mobile device, you need to install MSFT MDM on your personal phone, and they will, allegedly, be able to control stuff on it (depending on the device itself and how MDM is configured).
However, there are no requirements to do it. You can simply not install any work-related stuff on your phone, so you won't need an MDM. I simply don't access any work resources on my personal phone. If I need to do work, i open my work laptop. If they want me to use work apps on mobile and be accessible, they should provide a company phone for this.
There have been zero conflicts around it on my end, even after multiple years of working there on multiple different teams. Not once have I even got an implied request from anyone (managers, colleagues, etc.) to be accessible on mobile (except for when I am on-call, but for that, they just need my phone number, not any specific apps installed on my phone, and everyone knows it) or any questions about it. Everyone is totally cool with people not being glued to their work apps on their phones on their own free time.
But you are correct, those who choose to use work apps have to give MDM permissions to their personal devices or buy a dedicated device for that (exceptions apply, because there are some teams that provide dedicated work phones). However, unless it is required for the job to be able to use work apps on your mobile device, I think it is fair if they don't provide a work phone. Makes it easier for me to not check on any work stuff during the weekend.
It turns out that I can use our 2FA app without MDM, on my personal. And nowadays, I rarely use slack or email from mobile, and I don't get calls.
I am pretty strong in the "don't put company stuff on personal devices" camp. Even if they don't control your phone by policy, they do technically. They put root certs on the device, and though they can't see individual app data (depending on config) they can see a list of installed apps, and enforce certain baselines.
If you, as an employee, don't want to remove TikTok I believe you will have that right, it's just that you won't be able to access company emails from that device.
Now, whether or not that leads to a company phone or you having to look for another job, depends on the individual and how important that individual is to the company.
Perhaps I'm projecting a little, but: please don't feel like you're stuck there. It's an illusion more often than not.
Of all the hills I am willing to die on, getting another phone isn’t one. Especially if they provide a credit for your cell phone.
https://www.teamblind.com/post/Amazon-Cell-Phone-Reimburseme...
I personally just bought the cheapest $60-80 Android phone from a random Amazon seller.
It falls under the category of providing your own resources to do your job, and that territory enters socioeconomic discrimination territory real quick.
But for engineers and other office workers at tech companies?
As a practical matter, people have to buy lots of things to do professional jobs that they wouldn't need to buy without those jobs. In this day and age, if you want a second phone, buying a few year old phone is cheap as is adding another phone to your existing cellular account in most cases.
And, seriously, complaining about having to spend a few bucks for something you need at work is equivalent to circumstances around Indian treaties in the US?
Of course I do have other apps directly related to work... I guess those aren't an issue if I had TikTok?
He never got one, because as he said, if they have your number they'll call you, if they don't then they'll solve their own problem. Looking back on it now, it was prescient advice.
So what... Sometimes I go to the shop or bank during the day. Or even a walk to the beach if it's not so busy. They're paying me to do a (global) job, not to sit at my desk between 9:00 and 17:00.
Personally I love this flexibility. And I don't feel like I work more than 40 hours, I don't even count them but I doubt I do, especially if I omit the time I spend during "working hours" reading hacker news or other stuff. My work is my hobby anyway.
I do think people who like having fixed work times should have the opportunity to have them. But I also think people like me should be able to work like this without it being considered a bad thing.
I am too. Many years ago at my employer, someone fat-fingered a command and wiped every single iPhone/iPad that an employee had configured to connect the company email system. Even after restoring a backup, the devices would just wipe themselves again unless the owner managed to remove the MDM profile before it reconnected to the internet. A good fraction of my coworkers were affected.
I'm not giving anyone access to do that to my personal data.
After that I've never allowed an employer to control my personal devices. Not that I actually did before, didn't know activating that stuff had so bug implications. I just wanted the calendar on my phone.
For me, it's a minor inconvenience at best, not a death sentence.
If it does get to the point where I need to have access to my company email, I will have a separate device.
That being said, if my phone was erased, it would only be a slight inconvenience, I can restore from backup.
This was all much easier in the blackberry days for them to control
And indeed, that was Blackberry's big sales pitch.
BYOD creates many, many wonderful consequences, however it also has tradeoffs, and those tradeoffs are not for the faint-of-security.
If Amazon doesn't provide me a work phone, they can eff right off in attempting to dictate what I put on my phone.
In fact, TikTok explicitly left Hong Kong because if they didn't they would have to share private data with CCP to comply with new laws... they're intentionally leaving MAU on the table to keep their users' data safe. [1]
If you look around, US social companies are making the same mistake with your clipboard data that TikTok did. LinkedIn just got caught reading your clipboard data [2], but we aren't talking about banning them... I would assume in all of these cases, it's just an engineer who accidentally shipped a bug. There are legitimate use cases to read the clipboard (eg. more seamless 2fa).
It feels like the negative reaction to TikTok is so politicized and just comes from a "China bad" attitude.
[1]: https://www.cnn.com/2020/07/07/tech/tiktok-leaving-hong-kong...
https://rufposten.de/blog/2019/12/05/privacy-analysis-of-tik...
https://docs.google.com/document/d/1QEyWqAiTE_5xzCs_X3tjDCQx...
https://www.reddit.com/r/videos/comments/fxgi06/not_new_news...
https://www.washingtonpost.com/world/tiktoks-owner-is-helpin...
https://www.thetimes.co.uk/article/video-app-linked-to-china...
https://www.wired.com/story/tiktok-is-the-latest-window-into...
https://thehill.com/blogs/congress-blog/politics/478015-exer...
https://www.forbes.com/sites/zakdoffman/2020/06/26/warning-a...
Is this any less data than is collected by Facebook or Google in their apps/websites?
This seems like mostly an issue with the fact that Android lets apps get at this much data - something that should be fixed at the OS-level. There's very little mention of similar practices/vulnerabilities on iOS.
"... the device information, usage time and list of watched videos are being sent to Appsflyer and Facebook."
Hardly a smoking gun. Not only is this standard industry practice but the analytics servers in question here are American. The author says this violates European law (it doesn't). Then they go on to describe device fingerprinting which is also standard practice and has legitimate uses.
The second article's main point is that there are Chinese IP addresses in the APK and the privacy policies of different Chinese companies allow for data sharing.
The author doesn't witness any communication with these IP addresses. There are plenty of non-malicious reasons why a URL or IP address of a different company (Chinese or otherwise) would be in an APK. Maybe there is a library being used or the code in question might not even pertain to non-Chinese region versions. It would be like accusing a website of stealing data because they could use a Google font (interaction with Google IP address) and Google has such and such a privacy policy or history.
The famous Reddit comment which everyone seems to love is clearly fake. The author provided zero evidence when asked, saying that the hard drive on their MacBook failed and it is too difficult to "reverse engineer" the apps again. The accusations and methods are irredeemably vague. If the United States is going to become like China and start banning apps then it shouldn't be over a Reddit comment written by someone whose dog ate their homework.
Kind of goes against current shoe-horned American societal values of "everyone should be respected, regardless of who, what, how, when, where they are"
You're not wrong about TikTok, but 244 years and 6 days seems like a long time to consider a particular set of values "shoe-horned".
There's evidence that Bytedance is not independent of CCP interferences though - such as the CEO's public statement in 2018 where he stated that Bytedance products should support "socialist core values" etc.
https://chinamediaproject.org/2018/04/11/tech-shame-in-the-n...
Suggesting that TikTok is leaving MAU on the table to keep users' data safe is laughable when ByteDance's other Party-controlled app, DouYin, is remaining in Hong Kong with a captive audience (as helpfully confirmed by Global Times [2], a well-known mouthpiece of the Party). To even suggest that it's a sign of good intentions would ignore extremely important current events and ByteDance's self-proclaimed devotion to the Party. As we speak, the Party is aggressively assimilating Hong Kong into the mainland by banning public expressions of dissent, controlling educational curriculum, and yes, good old censorship. Forcing HK residents to use only Party-controlled tools that the rest of the mainland uses, like DouYin made by ByteDance, only serves to further the "work of Party construction".
TikTok is political because it is wholly owned by a self-proclaimed political entity: ByteDance. It's disingenuous to suggest there is no reason to assume malintent when ByteDance has a history of censorship and propaganda in its flagship app: DouYin. Your glib dismissal of "China bad" has no substance behind it, while China's ample human rights and totalitarian abuses speak for themselves. Putting the actions of independent private corporations in a free-speech democracy on the same level as the actions of a publicly-proclaimed ally of an authoritarian human rights abuser is plain nonsense. Context matters.
[1] https://chinamediaproject.org/2018/04/11/tech-shame-in-the-n...
[2] https://twitter.com/globaltimesnews/status/12803650546557911...
This, 100%.
The Chinese government's word is LAW. Just look at how many American tech companies have either a) been kicked out of China for refusing to hand over data to the CCP or given them backdoors or b) started censoring their services to stay in compliance and be allowed to stay in business there.
If the Chinese government wants something from a Chinese business, one of two things happens: 1) they get it (whether you find out about it or not) or 2) the business ceases to exist.
2. People don't use the app store at the pleasure of the US government.
Of course these companies have selfish corporate interests, but I've seen both of these companies show at least _some_ level of care for their users. Even if it's part of keeping up appearances out of concern for their corporate interests.
What benefit would they get?
There are country-specific Apple app stores and apps that are only available in some countries
They have no reason to add wood to that fire. Apple's best bet right now with this particular issue is to play neutrality.
At least for now. It's important to note that the Chinese government has a very strong campaign against American phones (and it's working), as backlash against the US for banning Huawei.
This is also why Apple is even less likely to do anything to further upset the CCP, not to mention they manufacture the bulk of their products there. But if Apple loses enough market share and/or moves enough production out of China, then they might change their tune as well.
That's true. However Apple's hands are tied here due to this and they always bend to the side of China. Due to this, they are still being accused of hypocrisy.
Google behaves the same way, even though they have no income from China right now, but I think they are secretly hopefully of dragonfly.
I think enough money can buy silence from a lot of people, plus it's clear google already has the tech, as they show a banner on every thing relating to covid (search results, YouTube) and do a quite impressive job at that. So I guess they can just tweak it for dragonfly, or even get their Chinese employees to do the tweak, since they already hire in China.
Once the growth slows, companies look for alternative revenue sources, like Apple is doing with services. The problem is that google has shown itself to be wildly incompetent at non engineering parts of their businesses other than search. e.g, Google cloud might be the only cloud to raise prices for anything so far(Google Kubernetes Engine price update)
It will be interesting to see what they choose. I don't think dragonfly can make them much money anyways, since Baidu too isn't making a lot of money in China.(When compared to how much Google makes in the US). I guess mostly due to closed mini app ecosystem on wechat, and probably a smaller internet eco system outside wechat.
If people are so worried about what tiktok can be gathering outside of the app, that is a problem for apple & google.
For this, I think it's 100% overblown what people think tiktok is doing. It just doesn't make sense. If it was really some kind of massive spyware, I agree apple/google would be all over this.. but they aren't.
This comes down to a lack of trust in China obviously, and I don't think there's anything really more concrete than that.
It can upload and download whatever to your phone.
No other app is even close to allowed that.
>No other app is even close to allowed that.
So an app that is on like a billions people phone is knowingly doing things against google & apples app store policy.. yet they choose to let one of the largest apps exploit them?
If you can read the above and not see why there is a pretty large obvious logic flaw then it's not even worth attempting to convince you otherwise...
https://www.reddit.com/r/videos/comments/fxgi06/not_new_news...
But then again, TikTok probably doesn't answer their subpoenas...
https://techcrunch.com/2020/01/29/facebook-will-pay-550-mill...
At that rate they can continue violating people's rights indefinitely, so I really don't see the difference.
The difference between "some" recourse and "no" recourse is not insignificant. It is exponentially harder to move the needle from "no recourse" to "some" than it is from "some" to "more."
China is increasingly an adversary to the US. That context is going to get a lot worse this decade. TikTok is owned by a Chinese company and ultimately must (and will) answer to China. Facebook, Google, et al. are of course American companies.
For a nation, whether Facebook concerns you as much as TikTok depends largely on which side you're on (or if you have a side at all).
The world is going to be aggressively bifurcated, US-USSR style, going forward. There will be the liberal side and the China side. China's direction is fundamentally opposed to the major liberal nations, what they commonly believe in and how their systems operate. That conflict and incompatibility will get worse as China's behavior continues to get worse.
Of course, this is a fact that everyone here is perfectly willing to admit when it comes to topics that are easy to take the "right" side on, like privacy, encryption, and net neutrality. When the topic gets more contentious, like allowing the ability for another country to collect data on the citizens of the US, its not so clear.
But, the core reasoning behind the issues are the same: we don't have the legal precedent to say that they're breaking the law. This is how new laws are made: we get executive or judicial precedent, this leads to a new law, and now they're breaking it. The law is not set in stone, and allowing applications like TikTok to exist simply because they're not breaking any existing laws is not the kind of conversation any decision makers are having right now, for the better.
Because the US Government, Google, and Apple share neither leadership nor most strategic goals.
The fact that they aren't doing anything that FB isn't already doing. The beef the USG has is that the CCP will have access to the data, not the fact that they are collecting the data at all.
The privacy hawks have been warning about this exact situation and people are now "surprised" when someone gets access to the data that they might not like.
Note: I'm not defending TikTok in any way here. I personally believe that nobody should be using it.
I think a better question to ask is, under what authority is the US government talking about banning TikTok? If there are clear security issues, or TikTok or the people running it are in violation of some US law, the onus is on the government to prove it. I haven't seen any proof of this, just a lot of hearsay.
[1] - https://www.msn.com/EN-US/news/technology/microsoft-secretly...
[2] - https://torrentfreak.com/how-to-stop-domain-names-being-seiz...
If there was a real security/privacy issue - I'd be more upset with Apple than China (as an iPhone user). Apple needs to watch my back.
The real question is why does your phone even allow such things to happen in the first place?
Actually moreso, in the case of the US government.
Why do you assume industrial espionage is the sole reason for a government to spy on you?
It seems way more likely that a non-tech manager at Amazon read the news and wrote the email.
What would the ramifications be if a ban were enacted? Retaliation from China against domestic companies?
Will this be an inflection point in the escalation of the trade war?
Millions of angry teenagers. China retaliates against by barring a few American SAAS companies/ cloud providers on national security grounds.
It's a continuation of trends that were well underway since the Huawei entities list.
https://chinamediaproject.org/2018/04/11/tech-shame-in-the-n...
I don't know how Bytedance as a company can serve CCP interests AND claim to be independent of CCP interference at the same time.
TikTok is a good product, but it may not be a safe product.
More on the dystopian practices of Douyin (TikTok in China): https://twitter.com/Izzy_Niu/status/1280906443273768960 https://twitter.com/JoshuaDummer/status/1280877750245453828
Someone mentions the copy/paste sec vuln in TikTok and “Onur Olmez” writes:
> LinkedIn app apparently also has this issue [...] Uncalled for to ban apps for this one reason.
I mean, wtf? Everybody on Twitter has an opinion about everything, even things they know nothing about.